[v6.1] BUG: sleeping function called from invalid context in lock_sock_nested (2)
3 views
Skip to first unread message
syzbot
Feb 22, 2025, 7:56:23 PM2/22/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 3a8358583626 Linux 6.1.129
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=160b47a4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ff93ecc085d8436e
dashboard link: https://syzkaller.appspot.com/bug?extid=3fd940c701b7555d6f7b
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3cc3985223b7/disk-3a835858.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e40398fb298b/vmlinux-3a835858.xz
kernel image: https://storage.googleapis.com/syzbot-assets/40469708dc9a/Image-3a835858.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3fd940...@syzkaller.appspotmail.com
BUG: sleeping function called from invalid context at net/core/sock.c:3490
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4305, name: kworker/u5:4
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
5 locks held by kworker/u5:4/4305:
#0: ffff0000d83d3138 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_one_work+0x6bc/0x1484 kernel/workqueue.c:2265
#1: ffff800021277c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6fc/0x1484 kernel/workqueue.c:2267
#2: ffff0000d88b8078 (&hdev->lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0xe8/0x9b0 net/bluetooth/hci_event.c:5021
#3: ffff0000d45b0c20 (&conn->lock#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#3: ffff0000d45b0c20 (&conn->lock#2){+.+.}-{2:2}, at: sco_conn_ready net/bluetooth/sco.c:1297 [inline]
#3: ffff0000d45b0c20 (&conn->lock#2){+.+.}-{2:2}, at: sco_connect_cfm+0x24c/0x8ec net/bluetooth/sco.c:1384
#4: ffff0000d9ae3130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1756 [inline]
#4: ffff0000d9ae3130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_conn_ready net/bluetooth/sco.c:1310 [inline]
#4: ffff0000d9ae3130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_connect_cfm+0x3d8/0x8ec net/bluetooth/sco.c:1384
Preemption disabled at:
[<ffff80001161a488>] spin_lock include/linux/spinlock.h:351 [inline]
[<ffff80001161a488>] sco_conn_ready net/bluetooth/sco.c:1297 [inline]
[<ffff80001161a488>] sco_connect_cfm+0x24c/0x8ec net/bluetooth/sco.c:1384
CPU: 1 PID: 4305 Comm: kworker/u5:4 Not tainted 6.1.129-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci4 hci_rx_work
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
__might_resched+0x37c/0x4d8 kernel/sched/core.c:9957
__might_sleep+0x90/0xe4 kernel/sched/core.c:9886
lock_sock_nested+0x88/0x138 net/core/sock.c:3490
lock_sock include/net/sock.h:1756 [inline]
sco_conn_ready net/bluetooth/sco.c:1310 [inline]
sco_connect_cfm+0x3d8/0x8ec net/bluetooth/sco.c:1384
hci_connect_cfm include/net/bluetooth/hci_core.h:1809 [inline]
hci_sync_conn_complete_evt+0x4f0/0x9b0 net/bluetooth/hci_event.c:5107
hci_event_func net/bluetooth/hci_event.c:7373 [inline]
hci_event_packet+0x744/0x109c net/bluetooth/hci_event.c:7425
hci_rx_work+0x310/0xa84 net/bluetooth/hci_core.c:4086
process_one_work+0x804/0x1484 kernel/workqueue.c:2292
worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 3a8358583626 Linux 6.1.129
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=160b47a4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ff93ecc085d8436e
dashboard link: https://syzkaller.appspot.com/bug?extid=3fd940c701b7555d6f7b
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3cc3985223b7/disk-3a835858.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e40398fb298b/vmlinux-3a835858.xz
kernel image: https://storage.googleapis.com/syzbot-assets/40469708dc9a/Image-3a835858.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3fd940...@syzkaller.appspotmail.com
BUG: sleeping function called from invalid context at net/core/sock.c:3490
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4305, name: kworker/u5:4
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
5 locks held by kworker/u5:4/4305:
#0: ffff0000d83d3138 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_one_work+0x6bc/0x1484 kernel/workqueue.c:2265
#1: ffff800021277c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6fc/0x1484 kernel/workqueue.c:2267
#2: ffff0000d88b8078 (&hdev->lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0xe8/0x9b0 net/bluetooth/hci_event.c:5021
#3: ffff0000d45b0c20 (&conn->lock#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#3: ffff0000d45b0c20 (&conn->lock#2){+.+.}-{2:2}, at: sco_conn_ready net/bluetooth/sco.c:1297 [inline]
#3: ffff0000d45b0c20 (&conn->lock#2){+.+.}-{2:2}, at: sco_connect_cfm+0x24c/0x8ec net/bluetooth/sco.c:1384
#4: ffff0000d9ae3130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1756 [inline]
#4: ffff0000d9ae3130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_conn_ready net/bluetooth/sco.c:1310 [inline]
#4: ffff0000d9ae3130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_connect_cfm+0x3d8/0x8ec net/bluetooth/sco.c:1384
Preemption disabled at:
[<ffff80001161a488>] spin_lock include/linux/spinlock.h:351 [inline]
[<ffff80001161a488>] sco_conn_ready net/bluetooth/sco.c:1297 [inline]
[<ffff80001161a488>] sco_connect_cfm+0x24c/0x8ec net/bluetooth/sco.c:1384
CPU: 1 PID: 4305 Comm: kworker/u5:4 Not tainted 6.1.129-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci4 hci_rx_work
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
__might_resched+0x37c/0x4d8 kernel/sched/core.c:9957
__might_sleep+0x90/0xe4 kernel/sched/core.c:9886
lock_sock_nested+0x88/0x138 net/core/sock.c:3490
lock_sock include/net/sock.h:1756 [inline]
sco_conn_ready net/bluetooth/sco.c:1310 [inline]
sco_connect_cfm+0x3d8/0x8ec net/bluetooth/sco.c:1384
hci_connect_cfm include/net/bluetooth/hci_core.h:1809 [inline]
hci_sync_conn_complete_evt+0x4f0/0x9b0 net/bluetooth/hci_event.c:5107
hci_event_func net/bluetooth/hci_event.c:7373 [inline]
hci_event_packet+0x744/0x109c net/bluetooth/hci_event.c:7425
hci_rx_work+0x310/0xa84 net/bluetooth/hci_core.c:4086
process_one_work+0x804/0x1484 kernel/workqueue.c:2292
worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Feb 22, 2025, 8:59:24 PM2/22/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 3a8358583626 Linux 6.1.129
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=154fb498580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14925fdf980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3cc3985223b7/disk-3a835858.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e40398fb298b/vmlinux-3a835858.xz
kernel image: https://storage.googleapis.com/syzbot-assets/40469708dc9a/Image-3a835858.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3fd940...@syzkaller.appspotmail.com
BUG: sleeping function called from invalid context at net/core/sock.c:3490
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 47, name: kworker/u5:0
#0: ffff0000d8e42138 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work+0x6bc/0x1484 kernel/workqueue.c:2265
#1: ffff80001d857c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6fc/0x1484 kernel/workqueue.c:2267
#2: ffff0000d3124078 (&hdev->lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0xe8/0x9b0 net/bluetooth/hci_event.c:5021
#3: ffff0000c3e18a20 (&conn->lock#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#3: ffff0000c3e18a20 (&conn->lock#2){+.+.}-{2:2}, at: sco_conn_ready net/bluetooth/sco.c:1297 [inline]
#3: ffff0000c3e18a20 (&conn->lock#2){+.+.}-{2:2}, at: sco_connect_cfm+0x24c/0x8ec net/bluetooth/sco.c:1384
#4: ffff0000cfe85130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1756 [inline]
#4: ffff0000cfe85130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_conn_ready net/bluetooth/sco.c:1310 [inline]
#4: ffff0000cfe85130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_connect_cfm+0x3d8/0x8ec net/bluetooth/sco.c:1384
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 3a8358583626 Linux 6.1.129
git tree: linux-6.1.y
kernel config: https://syzkaller.appspot.com/x/.config?x=ff93ecc085d8436e
dashboard link: https://syzkaller.appspot.com/bug?extid=3fd940c701b7555d6f7b
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=107057f8580000
dashboard link: https://syzkaller.appspot.com/bug?extid=3fd940c701b7555d6f7b
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14925fdf980000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3cc3985223b7/disk-3a835858.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e40398fb298b/vmlinux-3a835858.xz
kernel image: https://storage.googleapis.com/syzbot-assets/40469708dc9a/Image-3a835858.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3fd940...@syzkaller.appspotmail.com
BUG: sleeping function called from invalid context at net/core/sock.c:3490
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
5 locks held by kworker/u5:0/47:
RCU nest depth: 0, expected: 0
#0: ffff0000d8e42138 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work+0x6bc/0x1484 kernel/workqueue.c:2265
#1: ffff80001d857c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6fc/0x1484 kernel/workqueue.c:2267
#2: ffff0000d3124078 (&hdev->lock){+.+.}-{3:3}, at: hci_sync_conn_complete_evt+0xe8/0x9b0 net/bluetooth/hci_event.c:5021
#3: ffff0000c3e18a20 (&conn->lock#2){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline]
#3: ffff0000c3e18a20 (&conn->lock#2){+.+.}-{2:2}, at: sco_conn_ready net/bluetooth/sco.c:1297 [inline]
#3: ffff0000c3e18a20 (&conn->lock#2){+.+.}-{2:2}, at: sco_connect_cfm+0x24c/0x8ec net/bluetooth/sco.c:1384
#4: ffff0000cfe85130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1756 [inline]
#4: ffff0000cfe85130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_conn_ready net/bluetooth/sco.c:1310 [inline]
#4: ffff0000cfe85130 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_connect_cfm+0x3d8/0x8ec net/bluetooth/sco.c:1384
Preemption disabled at:
[<ffff80001161a488>] spin_lock include/linux/spinlock.h:351 [inline]
[<ffff80001161a488>] sco_conn_ready net/bluetooth/sco.c:1297 [inline]
[<ffff80001161a488>] sco_connect_cfm+0x24c/0x8ec net/bluetooth/sco.c:1384
CPU: 0 PID: 47 Comm: kworker/u5:0 Not tainted 6.1.129-syzkaller #0
[<ffff80001161a488>] spin_lock include/linux/spinlock.h:351 [inline]
[<ffff80001161a488>] sco_conn_ready net/bluetooth/sco.c:1297 [inline]
[<ffff80001161a488>] sco_connect_cfm+0x24c/0x8ec net/bluetooth/sco.c:1384
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: hci0 hci_rx_work
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
__might_resched+0x37c/0x4d8 kernel/sched/core.c:9957
__might_sleep+0x90/0xe4 kernel/sched/core.c:9886
lock_sock_nested+0x88/0x138 net/core/sock.c:3490
lock_sock include/net/sock.h:1756 [inline]
sco_conn_ready net/bluetooth/sco.c:1310 [inline]
sco_connect_cfm+0x3d8/0x8ec net/bluetooth/sco.c:1384
hci_connect_cfm include/net/bluetooth/hci_core.h:1809 [inline]
hci_sync_conn_complete_evt+0x4f0/0x9b0 net/bluetooth/hci_event.c:5107
hci_event_func net/bluetooth/hci_event.c:7373 [inline]
hci_event_packet+0x744/0x109c net/bluetooth/hci_event.c:7425
hci_rx_work+0x310/0xa84 net/bluetooth/hci_core.c:4086
process_one_work+0x804/0x1484 kernel/workqueue.c:2292
worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
---
If you want syzbot to run the reproducer, reply with:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
__might_resched+0x37c/0x4d8 kernel/sched/core.c:9957
__might_sleep+0x90/0xe4 kernel/sched/core.c:9886
lock_sock_nested+0x88/0x138 net/core/sock.c:3490
lock_sock include/net/sock.h:1756 [inline]
sco_conn_ready net/bluetooth/sco.c:1310 [inline]
sco_connect_cfm+0x3d8/0x8ec net/bluetooth/sco.c:1384
hci_connect_cfm include/net/bluetooth/hci_core.h:1809 [inline]
hci_sync_conn_complete_evt+0x4f0/0x9b0 net/bluetooth/hci_event.c:5107
hci_event_func net/bluetooth/hci_event.c:7373 [inline]
hci_event_packet+0x744/0x109c net/bluetooth/hci_event.c:7425
hci_rx_work+0x310/0xa84 net/bluetooth/hci_core.c:4086
process_one_work+0x804/0x1484 kernel/workqueue.c:2292
worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
---
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages